[BUG] MCP serve mode incorrectly applies directory restrictions designed for regular CLI mode

Environment

• Platform (select one):
• [x] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [ ] Other: <!-- specify -->
• Claude CLI version: 1.0.18 (also tested with 1.0.17)
• Operating System: macOS
• Terminal: Claude Desktop (MCP integration)

Bug Description

Claude Code's directory change restrictions, designed for regular CLI usage, are incorrectly being applied in MCP server mode. This fundamentally breaks the intended use case of MCP servers, which should be able to work across different repositories and directories as requested by the MCP client.

When Claude Code runs as an MCP server (claude mcp serve), it should not apply the same directory restrictions as regular CLI mode because:

1. MCP servers are meant to be repository-agnostic - they can be called from any directory/repository
2. MCP clients (like Claude Desktop) may need to work across multiple projects in a single session
3. The security model is different - the MCP client controls the scope, not the server

Steps to Reproduce

1. Configure Claude Desktop to use Claude Code as MCP server in claude_desktop_config.json:

``json
{
"mcpServers": {
"claude-code": {
"command": "claude",
"args": ["mcp", "serve"]
}
}
}
``

1. Start Claude Desktop with this configuration
2. Try to use the Bash tool to navigate to a different repository:

``bash
cd /path/to/different/repository
``

Expected Behavior

In MCP mode, Claude Code should allow directory navigation as requested by the MCP client without restrictions, since:

• The MCP client (Claude Desktop) controls the security boundary
• MCP servers are designed to be flexible tools that work across different contexts
• The user has explicitly configured the MCP server in their trusted environment

Actual Behavior

Version 1.0.18

Complete blocking with explicit error message:

Error: Tool Bash input is invalid: cd to '/path/to/repository' was blocked. For security, Claude Code may only change directories to child directories of the allowed working directories for this session (including '/').

Version 1.0.17

Partial functionality - commands execute but working directory is reset:

$ cd /path/to/repository && pwd
/path/to/repository
Shell cwd was reset to /

cd /path/to/repository && npx tsc --noEmit  # ✅ Works
cd /path/to/repository && git status       # ✅ Works

cd /path/to/repository  # ❌ Gets reset to /